Deploy Device Protection with Omnissa Workspace ONE

Use Omnissa Workspace ONE to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

All devices must be enrolled in Omnissa Workspace ONE Windows management before you begin.

Installation

1

What you'll need

Before starting, make sure you have the following from the Aikido Device Protection dashboard:

• Your PowerShell install command (copied from the user group selector on the dashboard, includes token + installer download)

If you're missing it, go back to the Aikido Device Protection dashboard, click Connect Device.

2

Run the install command on managed devices

1. In the Workspace ONE UEM console, go to Resources → Scripts.
2. Click Add and select Windows from the drop-down.
3. On the General tab, give the script a name (e.g. "Aikido Device Protection Install").
4. On the Details tab, set Language to PowerShell and Execution Context and Privileges to System Context.
5. Paste the PowerShell install command you copied from the Aikido dashboard into the script body.
6. On the Assignment tab, assign the script to the target Windows smart group and set the trigger to run on the next sample.
7. Click Save.
8. From the script's row in Scripts, click More → Run Now on a test device first and confirm a successful execution status before rolling out.

Scripts require Intelligent Hub on the device. Check deployment status under Devices → List View → device → More → Scripts.

3

Apply the lockdown policy

Workspace ONE does not expose a single toggle that blocks stopping a specific Windows service. Combine the two controls below to harden the agent against tampering.

Create two separate Workspace ONE profiles -- one to block uninstallation using AppLocker, and one to restrict access to the Windows Services console.

Block uninstall of the Aikido Device Protection application

1. In the Workspace ONE UEM console, go to Resources → Profiles & Baselines → Profiles.
2. Click Add → Add Profile, then select Windows → Windows Desktop → Device Profile.
3. Select the Application Control payload. Application Control uses Microsoft AppLocker to prevent users from adding or removing applications.
4. Paste the contents of aikido-applocker-deny-mdm.xml into the Application Control payload (open the link, copy the full XML text, and paste it here).
5. Assign the profile to the same smart group and click Save & Publish.

Restrict access to the Services console

1. Create a second profile: go to Resources → Profiles & Baselines → Profiles, click Add → Add Profile, then select Windows → Windows Desktop → Device Profile.
2. Select the Custom Settings payload.
3. Paste the following SyncML block into the Custom Settings payload:

   <SyncML>
     <SyncBody>
       <Replace>
         <CmdID>1</CmdID>
         <Item>
           <Target>
             <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_MMCSnapins/MMC_Services</LocURI>
           </Target>
           <Meta><Format xmlns="syncml:metinf">chr</Format></Meta>
           <Data><disabled/></Data>
         </Item>
       </Replace>
     </SyncBody>
   </SyncML>

4. Assign the profile to the same smart group and click Save & Publish.

The Aikido Device Protection installer also applies a service ACL that prevents standard users from stopping the EndpointProtection service directly. The Workspace ONE controls above add a second layer by stopping users from reaching the uninstaller or the Services console.

4

Reboot devices after installation

1. In the Workspace ONE UEM console, go to Devices → List View.
2. Filter to the target smart group, then select devices using Shift-click. (Avoid the global checkbox -- bulk actions may not trigger correctly with it.)
3. Click More Actions → Restart Device and confirm.

The agent fully activates on the next boot.

Troubleshooting

Problem	Fix
Device doesn't appear in the dashboard after the script runs	Reboot the device; the agent fully registers on the next boot
Script exits with an error in the MDM console	Run the script manually as SYSTEM on a test host to see the full error; confirm the device has internet access to download the installer
Agent service is not running	Reboot the device; if the service is still absent, re-run the install script
Script is blocked by execution policy	Scripts run via MDM execute as SYSTEM and bypass user-level execution policy restrictions; confirm the MDM is not applying an additional policy that restricts script execution
Device shows as inactive after installation	The agent needs a reboot to fully activate; check back after rebooting